safradocumentos[.]vercel[.]app

Analysis indicates that the domain safradocumentos.vercel.app is actively hosting a fraudulent page titled “Banco Safra – Envio de Documentos”. The site resolves to the IPv4 address 216.198.79.195, which is owned by Vercel, Inc. and geolocated to the United States. TLS is provided by Google Trust Services under the WR1 certificate, consistent with Vercel’s default hosting configuration. The page returns HTTP 200, confirming successful delivery of content. The domain is listed on one public blocklist and has been flagged by PhishDestroy. VirusTotal reports 14 of 91 scanners detecting malicious behavior, reinforcing the suspicion of abuse. Registration details show that the domain was provisioned through Vercel’s platform, a common vector for rapid deployment of malicious sites. No additional infrastructure such as dedicated C2 servers or alternative IPs has been observed. Defenders should block the domain and its resolved IP at network perimeter, monitor DNS queries for the domain, and consider adding it to internal blocklists. Continuous re‑evaluation is advised, as the hosting provider may reassign the IP to benign services if the malicious content is removed.